Executive brief
The Linux kernel's ARM System Control and Management Interface (SCMI) firmware driver contains a resource leak in mailbox channel setup. When a secondary TX receiver mailbox channel fails to initialize, the primary mailbox channel is not properly freed, leaving it busy and unavailable for future probe attempts. This can prevent the SCMI driver from functioning correctly on subsequent initialization attempts.
Technical details
The vulnerability exists in the mailbox_chan_setup() function within the arm_scmi transport driver. After successfully acquiring a primary mailbox channel, the code attempts to request an additional unidirectional TX receiver channel. If this second request fails, the function returns an error immediately without unwinding the primary channel allocation via mbox_free_channel(). This is a resource cleanup bug that can cause probe deferral or other setup failures to leave the mailbox channel in an allocated state, preventing subsequent probe attempts from acquiring it. The fix adds proper error handling with a goto label to ensure the primary channel is freed before returning the error.
Affected products
- Linux Linux kernel all versions with commit 9f68ff79ec2c and later (approximately Linux 5.19+)
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-07-14: patched: Fix committed upstream by Sudeep Holla